Threats tagged 'ghsa-4chg-4752-w88r'

NukeViet before version 4.6.00 contains a pre-authentication Server-Side Request Forgery (SSRF) vulnerability via the X-Forwarded-Host and X-Forwarded-Proto HTTP headers. An attacker can send a specially crafted POST request with the __serverInfoUpdate=1 parameter and spoof these headers to cause the server to issue a blind HEAD request to an attacker-controlled host. The vulnerability arises because the server uses these headers without proper validation to build a URL for a cURL request early in processing, before authentication. The SSRF is limited to a fixed request path and does not allow direct data exfiltration or internal remote code execution. However, it enables unauthenticated internal host and port discovery and poisoning of cached server headers.